Environment Matrix Validator

devops.validate_env_matrix

ProductionBounded custom (Class B)Deterministicstrictfastv1.0.0

No network

Overview

You pass up to 16 already-parsed environment maps and we report missing keys, drifting values, secret reuse, and schema violations. Values are never emitted — secrets are compared by digest only. This complements code.validate_env_file, which checks dotenv syntax for one file. Do not use this for dotenv file parsing.

Cross-environment diffs that echo values leak production secrets into agent logs. We compare by digest and report policy violations without exposing values.

Reliability

STRICT and deterministic — findings never contain values. Domain errors (not retryable — fix input): ENV_MATRIX_LIMIT_EXCEEDED (more than 16 environments or 1,000 keys — split the matrix); ENV_SCHEMA_INVALID (schema object is malformed — correct required/secret/allowedValues shapes); ENV_ENVIRONMENT_NAME_DUPLICATE (two environments share a name — use unique names). Policy violations such as ENV_KEY_MISSING and ENV_SECRET_REUSED appear in findings[] with valid:false.

Context footprint

One call replaces pairwise env diffs that would leak values into logs. A successful call costs 1 execution credit.

When to use it

When comparing already-parsed env maps for drift and policy.

When validating dotenv file syntax — use code.validate_env_file first.

Scope

Note

Compares already-parsed environment maps; never emits values.

Non-goals

Does not validate dotenv syntax (use code.validate_env_file)
Does not mutate environments or generate corrected files
Does not compare secret values in plaintext

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

validation

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call1 credit

File handling

Accepts file_refProduces file_refMax input256 KB

How we handle your data

Sensitive processing

What this means

This skill is designed to detect, mask, redact, validate, or otherwise process sensitive data.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
Targets sensitive data
The response does not contain submitted content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
environments	array	Yes	Bounded array of named environment variable maps. The item shape is defined by the nested schema and the array contains from 1 through 1000 items.
schema	object	No	Closed environment-variable schema with required, optional, secret, and equality rule properties; omit it to run presence and drift checks only. Its documented receipt properties are bounded to 256 entries — unconstrained RFC 8259 JSON items.
referenceEnvironment	string	No	Optional reference environment name; omit it to skip reference-equality checks.

Output schema

Field	Type	Required	Description
valid	boolean	Yes	Whether no error-severity environment finding exists.
environments	array	Yes	Bounded normalized environment names in caller order. The item shape is defined by the nested schema and the array contains from 0 through 1000 items.
findings	array	Yes	Bounded array of safe structured DevOps findings. The item shape is defined by the nested schema and the array contains from 0 through 20000 items.
matrix	array	Yes	Bounded variable-by-environment matrix rows. The item shape is defined by the nested schema and the array contains from 0 through 100000 items.
_meta	object	Yes	Closed environment validator metadata receipt. Its documented receipt properties are bounded to 256 entries — unconstrained RFC 8259 JSON items.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"devops.validate_env_matrix","input":{"environments":[{"name":"dev","variables":{"A":"1"}}]}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("devops.validate_env_matrix", {"environments":[{"name":"dev","variables":{"API_URL":"http://localhost","LOG_LEVEL":"DEBUG"}},{"name":"prod","variables":{"API_URL":"https://api.example.com"}}],"schema":{"required":["API_URL","LOG_LEVEL"]}});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.
ENV_MATRIX_LIMIT_EXCEEDED	429	No	A size, quota, rate, or time limit was exceeded.
ENV_SCHEMA_INVALID	400	No	The request payload failed this skill's input validation.
ENV_ENVIRONMENT_NAME_DUPLICATE	400	No	The request payload failed this skill's input validation.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not validate dotenv syntax (use code.validate_env_file)
Does not mutate environments or generate corrected files
Does not compare secret values in plaintext
Parsing raw .env file syntax
Generating corrected environment files

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "devops.validate_env_matrix",
  "input": {
    "environments": [
      {
        "name": "dev",
        "variables": {
          "API_URL": "http://localhost",
          "LOG_LEVEL": "DEBUG"
        }
      },
      {
        "name": "prod",
        "variables": {
          "API_URL": "https://api.example.com"
        }
      }
    ],
    "schema": {
      "required": [
        "API_URL",
        "LOG_LEVEL"
      ]
    }
  }
}

Examples

Missing required key in prod

Inputjson

{
  "environments": [
    {
      "name": "dev",
      "variables": {
        "API_URL": "http://localhost",
        "LOG_LEVEL": "DEBUG"
      }
    },
    {
      "name": "prod",
      "variables": {
        "API_URL": "https://api.example.com"
      }
    }
  ],
  "schema": {
    "required": [
      "API_URL",
      "LOG_LEVEL"
    ]
  }
}

Expected outputjson

{
  "findings": [
    {
      "details": {
        "environment": "prod",
        "key": "LOG_LEVEL"
      },
      "path": "prod/LOG_LEVEL",
      "code": "ENV_KEY_MISSING",
      "message": "Key 'LOG_LEVEL' is declared required but absent in 'prod'.",
      "severity": "error"
    }
  ],
  "matrix": [
    {
      "missingFrom": [],
      "key": "API_URL",
      "presentIn": [
        "dev",
        "prod"
      ],
      "secret": false,
      "distinctValueCount": 2,
      "identicalAcross": false
    },
    {
      "missingFrom": [
        "prod"
      ],
      "key": "LOG_LEVEL",
      "presentIn": [
        "dev"
      ],
      "secret": false,
      "distinctValueCount": 1,
      "identicalAcross": false
    }
  ],
  "valid": false,
  "_meta": {
    "comparisonsPerformed": 1,
    "environmentCount": 2,
    "keyCount": 2
  },
  "environments": [
    "dev",
    "prod"
  ]
}

Secret reused across staging and prod